Possible Phishing 🎣
on: ⚠️hxxps[:]//t[.]co/ZdZPdKaPB9
🧬 Analysis at: https://urldna.io/scan/69d91ea73b775000096db467
#cybersecurity #phishing #infosec #urldna #scam #infosec

🚨New ransom group blog post!🚨

Group name: kairos
Post title: South Florida Injury Centers
Info: https://cti.fyi/groups/kairos.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Apple macOS Privacy & Security settings may not reflect real access to protected folders, according to a demonstration by The Eclectic Light Company using a notarized test app called Insent. The author shows an app can regain access to Documents through Open and Save Panel intent even after the Files & Folders toggle is turned off, with testing on macOS Tahoe 26.4 and suspected impact from macOS 13.5 onward. The reported workaround is to reset TCC for the app and restart, although the author later noted MACL persistence may mean access is not fully cleared.

https://eclecticlight.co/2026/04/10/why-you-cant-trust-privacy-security/

#InfoSec #MacSecurity #Privacy

Apple-related court testimony cited by 404 Media says the FBI recovered incoming Signal message content from an iPhone's internal notification storage after the app had been removed. The report says only incoming notifications were captured, not outgoing messages, and no public technical details confirm exactly how the data was extracted. Signal offers a setting to hide message text in notifications, and the article indicates it was apparently not enabled in this case.

https://9to5mac.com/2026/04/09/fbi-used-iphone-notification-data-to-retrieve-deleted-signal-messages/

#InfoSec #Privacy #Signal

🚨New ransom group blog post!🚨

Group name: incransom
Post title: wright-ryan.com
Info: https://cti.fyi/groups/incransom.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

When an AI tool recommends an action and an employee carries it out, audit logs capture a legitimate human decision. The AI's role disappears. Addressing that blind spot takes more than awareness training.

https://zeltser.com/ai-influence-awareness-training

#cybersecurity #AI #securityawareness #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//guwpkqgd[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d8b5e83b775000096da600
#cybersecurity #phishing #infosec #urldna #scam #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//oxpainexecu[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d89ff63b77500007c1ca7e
#cybersecurity #phishing #infosec #urldna #scam #infosec

A security product becomes harder to displace when each persona finds value in their own view, from SOC analysts to execs to AI agents. Designing for all of them is a stronger advantage than a longer feature list.

https://zeltser.com/designing-for-humans-and-ai

#cybersecurity #productmanagement #AI #infosec

Aetna Reports Data Breaches Affecting Over 11,600 Members Due to Mailing Errors

Aetna reported two data breaches affecting 11,663 individuals caused by a mailing distribution error by a business associate that disclosed member information to unauthorized recipients.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/aetna-reports-data-breaches-affecting-over-11600-members-due-to-mailing-errors-5-g-b-o-e/gD2P6Ple2L

Possible Phishing 🎣
on: ⚠️hxxps[:]//breathtaking-intend-971835[.]framer[.]app/
🧬 Analysis at: https://urldna.io/scan/69d8c3e63b77500003cc2798
#cybersecurity #phishing #infosec #urldna #scam #infosec

My @OneRSAC information security book of the month review: Speak Security With A Business Accent: How to Communicate Cybersecurity Concepts Clearly, Ease Friction with Stakeholders & Influence Decision’ by Joshua Mason. Sage advice for #infosec pros. #RSAC https://www.rsaconference.com/library/blog/bens-book-of-the-month-speak-security

🔒 Security News Digest - 2026-04-10

📊 14 updates from 8 sources:

🔹 The Hacker News: GlassWorm Campaign Uses Zig Dropper to Infect Multiple Developer IDEs
https://thehackernews.com/2026/04/glassworm-campaign-uses-zig-dropper-to.html

🔹 darkreading: Industrial Controllers Still Vulnerable As Conflicts Move to Cyber
https://www.darkreading.com/ics-ot-security/industrial-controllers-vulnerable-conflicts-cyber

🔹 SecurityWeek: Juniper Networks Patches Dozens of Junos OS Vulnerabilities
https://www.securityweek.com/juniper-networks-patches-dozens-of-junos-os-vulnerabilities/

🔹 BleepingComputer: Analysis of one billion CISA KEV remediation records exposes limits of human-scale security
https://www.bleepingcomputer.com/news/security/analysis-of-one-billion-cisa-kev-remediation-records-exposes-limits-of-human-scale-security/

🔹 The Record from Recorded Future News: Florida investigates OpenAI for role ChatGPT may have played in deadly shooting
https://therecord.media/florida-investigates-openai-chatgpt-deadly-shooting

🔹 Security News | TechCrunch: France to ditch Windows for Linux to reduce reliance on US tech
https://techcrunch.com/2026/04/10/france-to-ditch-windows-for-linux-to-reduce-reliance-on-us-tech/

🔹 SecurityWeek: In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack
https://www.securityweek.com/in-other-news-cyberattack-stings-stryker-windows-zero-day-china-supercomputer-hack/

🔹 Security Boulevard: [un]prompted 2026 – Anatomy Of An Agentic Personal Al Infrastructure
https://securityboulevard.com/2026/04/unprompted-2026-anatomy-of-an-agentic-personal-al-infrastructure/

🦠 Malwarebytes: ClickFix finds a new way to infect Macs
https://www.malwarebytes.com/blog/news/2026/04/clickfix-finds-new-way-to-infect-macs

🔹 Security Boulevard: ClickFix finds a new way to infect Macs
https://securityboulevard.com/2026/04/clickfix-finds-a-new-way-to-infect-macs/

🔹 darkreading: Orange Business Reimagines Enterprise Voice Communications With Trust and AI
https://www.darkreading.com/endpoint-security/orange-business-enterprise-voice-comms

🔹 darkreading: FINRA Launches Financial Intelligence Fusion Center to Combat Cybersecurity and Fraud Threats
https://www.darkreading.com/threat-intelligence/finra-launches-financial-intelligence-fusion-center

🔹 BleepingComputer: Nearly 4,000 US industrial devices exposed to Iranian cyberattacks
https://www.bleepingcomputer.com/news/security/nearly-4-000-us-industrial-devices-exposed-to-iranian-cyberattacks/

🦠 Malwarebytes: Fake Claude site installs malware that gives attackers access to your computer
https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer

#InfoSec #SecurityNews

Possible Phishing 🎣
on: ⚠️hxxps[:]//instagram-uson[.]vercel[.]app
🧬 Analysis at: https://urldna.io/scan/69d8d8453b77500007c1cb23
#cybersecurity #phishing #infosec #urldna #scam #infosec

Built by a veteran #cybersecurity team & led by former @google and @Mandiant execs, Mallory AI is a new #AI intelligence platform & now in GA. It’s built for exposure investigation & intel workflows. Important for #infosec.
https://api.cyfluencer.com/s/mallory-goes-ga-introducing-our-ai-native-threat-intelligence-platform-26608 #MalloryAI #Mallory

Two wrongs don't make a right. They make multiple wrongs. There's no stopping this train wreck now.

"Anthropic describes Project Glasswing as a coalition of tech giants committing $100 million in AI resources to hunt down and fix long-hidden vulnerabilities in critical open source software that it's finding with its new Mythos AI program. Or as The Reg put it, 'an AI model that can generate zero-day vulnerabilities'."

The Register: Opinion: Project Glasswing and open source software: The good, the bad, and the ugly https://www.theregister.com/2026/04/10/project_glasswing/ @theregister @sjvn #Anthropic #Glasswing #infosec

The Register: CPUID site hijacked to serve malware instead of HWMonitor downloads https://www.theregister.com/2026/04/10/cpuid_site_hijacked/ @theregister @carlypage #infosec #malware

Chevin Fleet Solutions Disconnects FleetWave SaaS Following Cybersecurity Incident

Chevin Fleet Solutions took its FleetWave SaaS platform offline in the UK and US following a cybersecurity incident discovered on April 3, 2026. The company is conducting an investigation with external experts to secure Azure-hosted environments before restoration.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/chevin-fleet-solutions-disconnects-fleetwave-saas-following-cybersecurity-incident-o-9-4-8-3/gD2P6Ple2L

Security Week: Juniper Networks Patches Dozens of Junos OS Vulnerabilities https://www.securityweek.com/juniper-networks-patches-dozens-of-junos-os-vulnerabilities/ @SecurityWeek #infosec #vulnerability

Possible Phishing 🎣
on: ⚠️hxxps[:]//mtcfiber[.]weebly[.]com/
🧬 Analysis at: https://urldna.io/scan/69d902903b775000096db02f
#cybersecurity #phishing #infosec #urldna #scam #infosec

Oh my... I just stumbled upon a theoretical question:

If we have a data center in space, what should I tick in my information security and risk assessment regarding "data residency"? And which law does apply and does the answer to this change if the data center should not be geostationary?

Also, how should I assess the risk of Kessler syndrome?

#infosec #infsec #informationsecurity #riskmanagement #space #kessler_syndrome

🚨 New security advisory:

CVE-2026-1115 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-1115-parisneo-lollms-stored-xss

#InfoSec #ZeroDay #ThreatIntel

RE: https://flipboard.com/@404media/404-media-qvt3vv94z/-/a-qoIXNx-4Q-i9Qb4-DwsX5A%3Aa%3A4082434389-%2F0

If you think there's any chance that law enforcement might ever be interested in the content of your Signal chats, and you don't want them to have access to them, then setting up disappearing messages is necessary but not sufficient. You also need to go into the Signal settings and either disable notifications completely or set them to show "No name or message" so the content won't be capture and preserved in the phone's notification database.
#infosec #privacy #OpSec "#antifa"

AodeRelay boosted

404 Media » 🌐 2026-04-09
@404media@flipboard.com

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database
https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/?utm_source=flipboard&utm_medium=activitypub

Posted into 404 Media @404-media-404media

😂

Windows Central: Microsoft says Windows 11's bugs are all "resolved": At least the ones it knows about — and new bugs are impossible to avoid https://www.windowscentral.com/microsoft/windows-11/microsoft-says-windows-11-bugs-are-resolved @windowscentral #Microsoft #Windows #infosec

Possible Phishing 🎣
on: ⚠️hxxp[:]//amazon-clone-taupe-xi[.]vercel[.]app
🧬 Analysis at: https://urldna.io/scan/69d8d8523b775000096daa99
#cybersecurity #phishing #infosec #urldna #scam #infosec

Leak vs whistleblower ⚖️
Federal Bureau of Investigation makes arrest
Journalist: Seth Harp

Source: https://www.theguardian.com/us-news/2026/apr/08/fbi-arrests-ex-military-employee

💬 Your take?
🔔 Follow TechNadu

#InfoSec #CyberSecurity #Leaks

Alt...

FBI arrests ex-Fort Bragg employee over alleged classified leak to journalist

hey so this is probably completely pointless but: looking for a job (NZ or fully remote willing to hire a kiwi) in SRE, security, or linux/Unix system administration. 15 years expereince administering Linux and Unix boxes, intermediate level of experience working with docker compose and containerisation and container security. No prior job experience unfortunately, all those 15 years were mostly personal projects and small-scale stuff for friends. Currently running an entire multi-machine personal cloud infrastructure with a demonstration of all the services I have running at https://status.highenergymagic.net. Entirely willing to accept entry-level job placements, no expectation of being paid a lot or anything, just want to be doing something and move the needle a little on my current "being broke" status. #fedihired #infosec #cybersecurity #linux #unix #docker #sre #DevOps

Please boost for reach, any job offers please DM me.

IntraCare Healthcare Breach Forces Shutdown and Procedure Defers in New Zealand

New Zealand healthcare provider IntraCare suffered a cyber breach in March 2026, leading to a total IT shutdown, the theft of patient data, and the postponement of 28 medical procedures.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/intracare-healthcare-breach-forces-shutdown-and-procedure-defers-in-new-zealand-0-p-m-b-g/gD2P6Ple2L

Possible Phishing 🎣
on: ⚠️hxxps[:]//compra-shopee[.]vercel[.]app
🧬 Analysis at: https://urldna.io/scan/69d8a0073b775000096da354
#cybersecurity #phishing #infosec #urldna #scam #infosec

This dumb password rule is from Nelnet (student loan servicer).

8 to 15 characters and no spaces? Why no spaces? Also limited to only these 6 special characters. That could mean that there is some process somewhere that puts this as part of a command line invocation.

https://dumbpasswordrules.com/sites/nelnet-student-loan-servicer/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Deepfake law enforced ⚖️
Ted Cruz + Amy Klobuchar
First TAKE IT DOWN conviction
48hr takedown rule

Source: https://www.commerce.senate.gov/press/rep/release/cruz-klobuchar-take-it-down-act-leads-to-conviction-in-case-targeting-ai-generated-deepfakes/

🔔 Follow @technadu

#InfoSec #AI #Deepfakes

Alt...

Cruz, Klobuchar TAKE IT DOWN Act Leads to Conviction in Case Targeting AI-Generated Deepfakes

🚨New ransom group blog post!🚨

Group name: pear
Post title: Arkansas Oral & Maxillofacial Surgeons
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Colonial Presbyterian Church
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//westernuni0ninternationaltransactions[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d899bb3b775000096da2b8
#cybersecurity #phishing #infosec #urldna #scam #infosec

New by me: Microsoft’s WireGuard and VeraCrypt lockout is bigger than a support issue.

What stood out to me is not just the headline. It is how quickly a centralized trust and signing pipeline can become a chokepoint for tools people rely on for privacy and security.

https://www.kylereddoch.me/blog/microsofts-wireguard-and-veracrypt-lockout-is-bigger-than-a-support-failure/

Also, shoutout to @cjerrington for putting this on my radar.

#cybersecurity #infosec #privacy #WireGuard #VeraCrypt #Microsoft #Windows

Proton built their entire brand on one promise: Swiss law means government agencies can't touch your data.
Their own Terms of Service, their own infrastructure contracts, and a federal court case from March say otherwise.

https://blog.ppb1701.com/not-even-government-agencies

#bigtech #blog #infosec #privacy #proton #protonmeet #security #surveillance #userhostile #selfhosting

🚨New ransom group blog post!🚨

Group name: akira
Post title: Netgain Networks
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: Turbo International
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Credential Exposure Impacts 12 Hungarian Government Ministries

A Bellingcat investigation revealed that nearly 800 Hungarian government credentials from 12 ministries were leaked in breach databases due to poor digital hygiene and infostealer malware.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/credential-exposure-impacts-12-hungarian-government-ministries-4-e-k-9-1/gD2P6Ple2L

Possible Phishing 🎣
on: ⚠️hxxps[:]//myvisionsfedcuonlineghvfcuindexphp[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d8ae103b77500008af6520
#cybersecurity #phishing #infosec #urldna #scam #infosec

Everything here is reproducible from the Google Play APK with jadx.

APK: com.eg.android.AlipayGphone v10.8.50.7000
SHA-256: 7b56faa5a0de644fd1803e2a002654e0abec45c9d72a1489ea220c04121a7587

IACR ePrint 2026/526
Zenodo: 10.5281/zenodo.19186848
IPFS: QmeWzqWUfHToBTcuPVSfrzxMDiPT6F48M7qtDVXRBHwhHS
https://github.com/sgInnora/alipay-securityguard-analysis

If you work on Google Play policy review, or if you're a security researcher who can independently verify — please look at this APK.

#infosec #googleplay #android #privacy

9-hour exploit window ⚠️
Marimo RCE → active
Sysdig saw credential theft
Patch fast.

Source: https://www.securityweek.com/critical-marimo-flaw-exploited-hours-after-public-disclosure/

🔔 Follow @technadu

#InfoSec #RCE #CyberSecurity

Alt...

Critical Marimo Flaw Exploited Hours After Public Disclosure

Alipay (100M+ Google Play installs) — what I found by reverse-engineering the APK:

1. A remotely activatable SSL/TLS kill switch
2. 79,371 server-replaceable methods bypassing Play review
3. 1,834 undisclosed data hooks (IMEI, GPS, clipboard, audio)
4. 97% of permission checks return null

Ant Group's response: "these vulnerabilities do not exist."

40 days later, the SSL bypass is still in production.

Thread with code evidence ↓

#infosec #android #alipay #googleplay

Possible Phishing 🎣
on: ⚠️hxxps[:]//093421tr[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d883ef3b77500004a8ab4f
#cybersecurity #phishing #infosec #urldna #scam #infosec

I get a call from my insurance company basically saying "please give us all your information in order to confirm what we have on file".

Are you kidding me?

You call me, out of the blue, and I'm supposed to recite to you ALL of my PERSONAL INFORMATION over an insecure channel like the telephone, where anyone can make up their Caller ID and can represent themselves as whoever they want?

Holy shit, talk about red flags!

#OpSec #InfoSec #Privacy #InformationPrivacy

🔒 Security News Digest - 2026-04-10

📊 18 updates from 5 sources:

🔹 SecurityWeek: MITRE Releases Fight Fraud Framework
https://www.securityweek.com/mitre-releases-fight-fraud-framework/

🔹 BleepingComputer: Google rolls out Gmail end-to-end encryption on mobile devices
https://www.bleepingcomputer.com/news/google/google-rolls-out-gmail-end-to-end-encryption-on-mobile-devices/

🔹 SecurityWeek: Chrome 147 Patches 60 Vulnerabilities, Including Two Critical Flaws Worth $86,000
https://www.securityweek.com/chrome-147-patches-60-vulnerabilities-including-two-critical-flaws-worth-86000/

🔹 The Hacker News: Browser Extensions Are the New AI Consumption Channel That No One Is Talking About
https://thehackernews.com/2026/04/browser-extensions-are-new-ai.html

🔹 Security Boulevard: How AI Is Reshaping Wholesale Network Defense
https://securityboulevard.com/2026/04/how-ai-is-reshaping-wholesale-network-defense/

🔹 Security Boulevard: How Acronis and SuperOps help MSPs work smarter with integrated cyber protection
https://securityboulevard.com/2026/04/how-acronis-and-superops-help-msps-work-smarter-with-integrated-cyber-protection/

🔹 Security Boulevard: How AutoSecT Simplifies Audit Preparation for Global Enterprises
https://securityboulevard.com/2026/04/how-autosect-simplifies-audit-preparation-for-global-enterprises/

🔹 Security Boulevard: The Security Gap Hiding in Your Salesforce Org
https://securityboulevard.com/2026/04/the-security-gap-hiding-in-your-salesforce-org/

🔹 Security Boulevard: Breach of Confidence: 10 April 2026
https://securityboulevard.com/2026/04/breach-of-confidence-10-april-2026/

🔹 Security Boulevard: When Privacy Laws Force You to Know Too Much: The Perverse Incentives of Age Verification Regimes
https://securityboulevard.com/2026/04/when-privacy-laws-force-you-to-know-too-much-the-perverse-incentives-of-age-verification-regimes/

🔹 SecurityWeek: Orthanc DICOM Vulnerabilities Lead to Crashes, RCE
https://www.securityweek.com/orthanc-dicom-vulnerabilities-lead-to-crashes-rce/

🔹 BleepingComputer: Microsoft: Canadian employees targeted in payroll pirate attacks
https://www.bleepingcomputer.com/news/microsoft/microsoft-canadian-employees-targeted-in-payroll-pirate-attacks/

🔹 Security Boulevard: Authentication Solutions for Businesses: Benefits, Use Cases, and More
https://securityboulevard.com/2026/04/authentication-solutions-for-businesses-benefits-use-cases-and-more/

🔹 Security Boulevard: Best Sentry Alternatives for Error Tracking and Monitoring (2026)
https://securityboulevard.com/2026/04/best-sentry-alternatives-for-error-tracking-and-monitoring-2026-2/

🔹 Security Boulevard: What Is an LLM Proxy and How Proxies Help Secure AI Models
https://securityboulevard.com/2026/04/what-is-an-llm-proxy-and-how-proxies-help-secure-ai-models/

🔹 SecurityWeek: Industry Reactions to Iran Hacking ICS in Critical Infrastructure: Feedback Friday
https://www.securityweek.com/industry-reactions-to-iran-hacking-ics-in-critical-infrastructure-feedback-friday/

🔹 The Record from Recorded Future News: UK says it exposed Russian submarine activity near undersea cables
https://therecord.media/uk-says-it-exposed-russian-submarine-activity

🔹 BleepingComputer: Supply chain attack at CPUID pushes malware with CPU-Z/HWMonitor
https://www.bleepingcomputer.com/news/security/supply-chain-attack-at-cpuid-pushes-malware-with-cpu-z-hwmonitor/

#InfoSec #SecurityNews

From call scripts and scams to command and control—Southeast Asia’s scam centres are levelling up.

In our latest research with Chong Lua Dao, we track a sophisticated Android banking trojan directly to the K99 Triumph City scam compound in Sihanoukville, Cambodia, and the high-ranking political elites behind it.

Using a combination of technical analysis, infrastructure patterns, and operational visibility provided by former captives, we were able to map thousands of targeted lure and C2 domains used to distribute and administer the malware across Asia, Africa, Europe, and Latin America.

What we uncovered is a turnkey malware-as-a-service (MaaS) platform sold to scam-centre based criminal networks, including K99, enabling real-time surveillance, credential theft, biometric data exfiltration, and financial fraud on a global scale. Victims are funnelled through domains impersonating government services, financial institutions, e-commerce platforms and airlines, with new domains registered every month.

In addition to giving criminal operators complete control over infected devices, behind the malware sits a highly coordinated operation. Our investigation unpacks the whole thing, revealing multiple C2 panels organised by country and “customer” as well as the integration of AI-driven tools used to support attacks targeting victims in at least 21 countries and 15 languages.

What’s more, we have found that there is significant overlap with the infrastructure and business networks attributed to the DNS threat actors Vigorish Viper and Vault Viper, highlighting the continued evolution of the regional cyber threat landscape.

👉 Read the full report here: https://www.infoblox.com/blog/threat-intelligence/scams-slaves-and-malware-as-a-service-tracking-a-trojan-to-cambodias-scam-centers/
👉 We spoke to the Economist to explain how the scam centre threat is shifting: https://www.economist.com/interactive/asia/2026/04/10/scam-inc-has-a-new-weapon?fsrc=core-app-economist

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #malware #scam

🚨 New for BSides Luxembourg 2026! 🚨

📱🗺️ Navigate the Conference Like a Pro with 𝗛𝗔𝗖𝗞𝗘𝗥 𝗧𝗥𝗔𝗖𝗞𝗘𝗥!

Keeping up with everything at #BSidesLuxembourg2026 can be… a challenge 😅

With 5 stages, 2 dedicated villages, live recordings, activities in the Atrium, and multiple workshops running in parallel—it’s easy to miss something awesome.

So we’ve made it easier 👇

The full conference schedule is now available on the Hacker Tracker app, making it simple to:

📅 Browse all sessions in one place
⏰ Track what’s happening in real time
⭐ Plan your personal schedule
📍 Never miss the talks you care about

👉 Check it out here: https://lnkd.in/dejd-4xm

#BSidesLuxembourg2026 #HackerTracker #CyberSecurity #Infosec #ConferenceLife #BSides

Tulane University Employee Data Breach via Oracle EBS Vulnerability

Tulane University reports a data breach exposing employee data after the Cl0p ransomware group exploited a zero-day vulnerability in the Oracle E-Business Suite to steal Social Security numbers and banking details.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/tulane-university-employee-data-breach-via-oracle-ebs-vulnerability-a-e-d-1-t/gD2P6Ple2L

Excited to announce: @cxiao will be speaking at @rustconf in Montréal this year, with the talk "Reverse Engineering Rust Malware in 2026"! https://sched.co/2KHt7

The widespread adoption of Rust has not only led to an increase in legitimate Rust software, but also an explosion in malware written in Rust. How are malware reverse engineers tackling Rust malware, in 2026?

The talk will walk through the analysis of a Rust malware sample, look at the limitations of program analysis and decompilation tools, and discuss the challenges in teaching Rust reverse engineering to malware analysts.

Get your ticket for RustConf today: https://rustconf.com/register?utm_source=speaker_referral&utm_medium=referral

#RustConf #RustConf26 #Rust #RustLang #Infosec #Malware #MalwareAnalysis #Reversing #ReverseEngineering

Alt...

RustConf 2026 Hosted by the Rust Foundation "Reverse Engineering Rust Malware in 2026" Breakout Session - Sept. 09 Cindy Xiao Security Researcher, Decoder Loop RustConf 2026 - Montreal + Online rustconf.com

Possible Phishing 🎣
on: ⚠️hxxps[:]//135461223[.]site/465/7717c2b3-2f3a-4816-a65c-39bf9267f74a/728738
🧬 Analysis at: https://urldna.io/scan/69d8d2043b775000060681d8
#cybersecurity #phishing #infosec #urldna #scam #infosec

hey so this is probably completely pointless but: looking for a job (NZ or fully remote willing to hire a kiwi) in SRE, security, or linux/Unix system administration. 15 years expereince administering Linux and Unix boxes, intermediate level of experience working with docker compose and containerisation and container security. No prior job experience unfortunately, all those 15 years were mostly personal projects and small-scale stuff for friends. Currently running an entire multi-machine personal cloud infrastructure with a demonstration of all the services I have running at https://status.highenergymagic.net. Entirely willing to accept entry-level job placements, no expectation of being paid a lot or anything, just want to be doing something and move the needle a little on my current "being broke" status. #fedihired #infosec #cybersecurity #linux #unix #docker #sre #DevOps #GetFediHired

Please boost for reach, any job offers please DM me.

New.

"We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond."

Sophos: The vulnerability flood is here. Here’s what it means – and how to prepare https://www.sophos.com/en-us/blog/vulnerability-flood-is-here @SophosXOps #infosec

We invest hours analyzing a security risk, and that effort makes us overvalue the recommendation. An executive who hasn't shared that analysis weighs the same risk differently, and they might be right.

https://zeltser.com/rejected-security-recommendations

#cybersecurity #securityleadership #CISO #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//mailforapps[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d78e913b775000092347c6
#cybersecurity #phishing #infosec #urldna #scam #infosec

🔒 Security News Digest - 2026-04-09

📊 15 updates from 5 sources:

🔹 Security Boulevard: AI SOC and SIEM Are Being Repriced
https://securityboulevard.com/2026/04/ai-soc-and-siem-are-being-repriced/

🔹 Security Boulevard: When We Use AI To Ship Fast, Secrets Spread Fast
https://securityboulevard.com/2026/04/when-we-use-ai-to-ship-fast-secrets-spread-fast/

🔹 Security Boulevard: The Most Important Cybersecurity Trends in 2026 So Far
https://securityboulevard.com/2026/04/the-most-important-cybersecurity-trends-in-2026-so-far/

🔹 BleepingComputer: When attackers already have the keys, MFA is just another door to open
https://www.bleepingcomputer.com/news/security/when-attackers-already-have-the-keys-mfa-is-just-another-door-to-open/

🔹 Security Boulevard: Trump’s Proposed $707 Million CISA Budget Cut a ‘Gift to Nation-State Actors’
https://securityboulevard.com/2026/04/trumps-proposed-707-million-cisa-budget-cut-a-gift-to-nation-state-actors/

🔹 Security Boulevard: React2DoS (CVE-2026-23869): When the Flight Protocol Crashes at Takeoff
https://securityboulevard.com/2026/04/react2dos-cve-2026-23869-when-the-flight-protocol-crashes-at-takeoff/

🔹 Security Boulevard: LangChain, Langflow, LiteLLM: When AI’s Foundation Code Becomes the Attack Surface
https://securityboulevard.com/2026/04/langchain-langflow-litellm-when-ais-foundation-code-becomes-the-attack-surface/

🔹 Security Boulevard: [un]prompted 2026 – Al Go Beep Boop!
https://securityboulevard.com/2026/04/unprompted-2026-al-go-beep-boop/

🔹 The Record from Recorded Future News: Russia accuses former Radio Free Europe journalist of aiding cyberattacks for Ukraine
https://therecord.media/russia-accuses-radio-free-europe-journalist-aiding-ukraine-cyberattack

🔹 Security News | TechCrunch: Hacker stole £700,000 from U.K. energy company by redirecting payment
https://techcrunch.com/2026/04/09/hacker-stole-700000-from-u-k-energy-company-by-redirecting-payment/

🔹 Security Boulevard: Aembit IAM for Agentic AI Is Now Generally Available
https://securityboulevard.com/2026/04/aembit-iam-for-agentic-ai-is-now-generally-available/

🔹 Security Boulevard: The Web Is Full of Traps — and AI Agents Walk Right into Them
https://securityboulevard.com/2026/04/the-web-is-full-of-traps-and-ai-agents-walk-right-into-them/

🔹 Security Boulevard: OpenAI Readies Rollout of New Cyber Model as Industry Shifts to Defense
https://securityboulevard.com/2026/04/openai-readies-rollout-of-new-cyber-model-as-industry-shifts-to-defense/

🔹 BleepingComputer: Smart Slider updates hijacked to push malicious WordPress, Joomla versions
https://www.bleepingcomputer.com/news/security/smart-slider-updates-hijacked-to-push-malicious-wordpress-joomla-versions/

🔹 The Hacker News: UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns
https://thehackernews.com/2026/04/uat-10362-targets-taiwanese-ngos-with.html

#InfoSec #SecurityNews

Palo Alto posted several advisories yesterday, if you missed them:

- Critical: CVE-2026-0234 Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration https://security.paloaltonetworks.com/CVE-2026-0234

- PAN-SA-2026-0004 Chromium: Monthly Vulnerability Update (April 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0004

- CVE-2026-0233 Autonomous Digital Experience Manager: Improper validation of ADEM certificate https://security.paloaltonetworks.com/CVE-2026-0233 #PaloAlto #infosec #vulnerability #Chromium

New.

Kaspersky: The long road to your crypto: ClipBanker and its marathon infection chain https://securelist.com/clipbanker-malware-distributed-via-trojanized-proxifier/119341/ @Kaspersky #infosec #threatresearch #malware

CISA adds CVE-2026-1340 (Ivanti EPMM) to KEV ⚠️

Active exploitation confirmed
Known vulns = real attack surface
Are KEVs in your patch priority?

Source: https://www.cisa.gov/news-events/alerts/2026/04/08/cisa-adds-one-known-exploited-vulnerability-catalog

💬 Engage
🔔 Follow TechNadu

#InfoSec #KEV #CISA #VulnMgmt

Alt...

CISA Adds One Known Exploited Vulnerability to Catalog

Daily drop: insights on ransomware, data breaches, and more. Don’t miss today’s playlist. 🔐 https://www.youtube.com/playlist?list=PLXqx05yil_meOBEDbQ3alsMQQTq72vt_r

#Ransomware #DataSecurity #InfoSec #OnlineSafety #DarkWeb

Possible Phishing 🎣
on: ⚠️hxxps[:]//1vfcuonline[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d772643b7750000923440b
#cybersecurity #phishing #infosec #urldna #scam #infosec

CISA has added two industrial advisories today: https://www.cisa.gov/

An Ivanti vulnerability was added yesterday:

CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-1340 #infosec #CISA #Ivanti #vulenrability

Bitdefender: What Mythos Reveals About Zero Trust’s Scope Problem https://www.bitdefender.com/en-us/blog/businessinsights/mythos-reveals-zero-trust-scope-problem #infosec #zerotrust #Mythos

Ransomware.live:

- United Medical Doctors https://www.ransomware.live/id/VW5pdGVkIE1lZGljYWwgRG9jdG9yc0BpbnNvbW5pYQ

- Minnesota Health Insurance Network https://www.ransomware.live/id/TU4gSGVhbHRoIEluc3VyYW5jZSBOZXR3b3JrQGFraXJh

- Signature Healthcare https://www.ransomware.live/id/U2lnbmF0dXJlIEhlYWx0aGNhcmVAYW51Ymlz

More https://www.ransomware.live/ #infosec #ransomware

Big thank you to our hosts Wellington and food and beverage sponsors Plextrac for supporting this month's meetup.

We have two talks again with Emile Delcourt talking on AI Agents Honeypots before after OpenClaw and Eitan Worcel about Security Backlog in the Age of AI.

Still have a chance to RSVP at https://buff.ly/JrK6hY1

#aisecurity #infosec #cybersecurity

Possible Phishing 🎣
on: ⚠️hxxps[:]//ahmedsoumri[.]github[.]io/NETFLIX/
🧬 Analysis at: https://urldna.io/scan/69d7b8ac3b77500009234dec
#cybersecurity #phishing #infosec #urldna #scam #infosec

One of my first interactions with encryptions was PGP, by Philip Zimmermann

I wanted certain emails to be encrypted with a public private key pair combination

In reading Zimmermann, documentation I noticed that there could be something wrong.

Source code openness and other eyeballs were needed.

## We got that in openGPG

I've NEVER trusted closed source encryption schemes.

I sometimes also verify if the shadow that's following me is actually mine

@h3artbl33d @Rairii

#InfoSec #programming #encryption #VeraCrypt #WireGuard #WindScribe #technology #microSlop

🚨New ransom group blog post!🚨

Group name: akira
Post title: MN Health Insurance Network
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//shawsynre1[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d75ca23b775000092340bc
#cybersecurity #phishing #infosec #urldna #scam #infosec

‘Breaking News:’ Water is wet

Article - “INTERNET-EXPOSED ICS DEVICES RAISE ALARM FOR CRITICAL SECTORS”

#ics #ot #scada #infosec

https://securityaffairs.com/190525/ics-scada/internet-exposed-ics-devices-raise-alarm-for-critical-sectors.html

Most tools that give you deep forensic flexibility weren't built for enterprise scale. And most enterprise tools weren't built by people who actually work incidents.

John Strand, Owner of Black Hills Information Security, says LimaCharlie is the exception.

During an active incident, the BHIS SOC can pull the telemetry and data they need quickly, without query caps, unnecessary clicks, or waiting.

LimaCharlie delivers security as composable, API-first primitives, giving teams full control over how they collect, query, and act on telemetry. All of it normalized to a single JSON format, stored free for a rolling year, and queryable when it matters most.

Learn more: https://limacharlie.io

#cybersecurity #infosec #soc #mssp

So #InfoSec people, are you actually worried about #Mythos and Project Glasswing or are you writing it off as yet another AI marketing stunt?

This dumb password rule is from Itaú Bank.

I know, it's in spanish, let me translate this monstrosity for you.

- Allowed characters: letters A to Z uppercase or lowercase (ñ is not allowed), number 0 to 9, #, $, %, &, +, -, . :, ;, _.
- You must use 8 characters.
- The password must contain at least one letter and at least one number.
- ...

https://dumbpasswordrules.com/sites/itau-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

From my perspective not only what you have pointed out, is horrific
The following DANGEROUS outcome is also looming for everyone globally

• Inability to buy critical parts for Computing Systems vehicles medical devices because of greed of the manufacturing Triple Cartel

• LLM crafted Ponzi Schemes

• Dubious role of USA based companies and proxies

• Unwilling Supreme Court and regional Court Systems and District Attorneys to hunt down and disable Ponzi Schemes

• Facilitating US government in all

This is the housing Ponzi Schemes repeated

Thank you for your wonderful input
🦋💙❤️💋#Lobi 💙💕🌹💐💙🦋

@rl_dane

#curl #LLM #hallucinated #slop #AI #InfoSec #programming #technology

What if the biggest security gap in your environment isn't some zero-day, it's DNS?
At BSides312, Matt Scheurer is bringing live demos breaking down how DNS works, why attackers love it, and why most security teams are sleeping on it.
Easily one of the most versatile protocols; problem in your network? Somehow it always comes back to DNS. Don't sleep on this talk.
May 16th. Chicago.
🎟️ https://bsides312.org
#BSides312 #InfoSec #DNS #NetworkSecurity #CyberSecurity #Chicago

Google Chrome 147 Update Patches 60 Vulnerabilities Including Two Critical WebML Flaws

Google Chrome 147 patches 60 vulnerabilities, including two critical memory corruption flaws in the WebML component that could allow remote code execution. The update also addresses numerous high-severity use-after-free and buffer overflow issues across the V8 engine, Blink, and WebRTC.

**Once more, a huge patch for Chrome and Chromium based browsers (Edge, Opera, Brave, Vivaldi...). Don't delay this one, it has two critical flaws and a bunch of others. It's only a matter of time before some get exploited. So don't wait. Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-chrome-147-update-patches-60-vulnerabilities-including-two-critical-webml-flaws-x-2-8-3-e/gD2P6Ple2L

Possible Phishing 🎣
on: ⚠️hxxps[:]//amazon-clone-ochre-three[.]vercel[.]app/
🧬 Analysis at: https://urldna.io/scan/69d79ca43b77500009234a0b
#cybersecurity #phishing #infosec #urldna #scam #infosec

NHS Scotland subdomains hijacked ⚠️
• Adult content + illegal streams hosted
• Likely DNS / WordPress compromise
• Legacy infrastructure exploited

Trust-based attacks are rising 👇

https://www.technadu.com/nhs-scotland-domain-breached-to-host-adult-content-and-illegal-sports-streams-exposing-infrastructure-vulnerabilities/625623/

#Infosec #Cybersecurity #DNSSecurity

Alt...

NHS Scotland Domain Breached to Host Adult Content and Illegal Sports Streams, Exposing Infrastructure Vulnerabilities

⛔ New security advisory:

CVE-2026-39339 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-39339-churchcrm-auth-bypass

#InfoSec #ZeroDay #ThreatIntel

The average cost of a thorough pre-acquisition cybersecurity assessment for mid-market transactions sits at approximately $125,000, dwarfing the potential returns on investment that can be achieved through breach avoidance, deal price optimization, and regulatory penalty avoidance.

Where would what lies hidden in your investment portfolios? priv... break first in your environment?

Read more: https://steelefortress.com/fortress-feed/what-lies-hidden-in-your-investment-portfolios-private-equity-and-venture-capital-cybersecurity-due-diligence-you-cant-ignore

CyberSecurity #IncidentResponse #InfoSec #Security

🎥 Watch Teaser: https://steelefortress.com/70w5dq

🚨New ransom group blog post!🚨

Group name: pear
Post title: The McLamb Group, Inc
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Siegel Lewitter Malkani
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Family Psychological Associates
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: pear
Post title: Powell, Powell & Powell, P.A.
Info: https://cti.fyi/groups/pear.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//roblox[.]com[.]ge/communities/5032828635/
🧬 Analysis at: https://urldna.io/scan/69d7b1173b77500009234ce1
#cybersecurity #phishing #infosec #urldna #scam #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: Sehlmann Fensterbau
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: Newman & Marquez
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

🚨New ransom group blog post!🚨

Group name: akira
Post title: ImageMaster
Info: https://cti.fyi/groups/akira.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//ahmedsiddiqui1948-tech[.]github[.]io/Amazon-clone/
🧬 Analysis at: https://urldna.io/scan/69d7aab63b77500009234bf4
#cybersecurity #phishing #infosec #urldna #scam #infosec

Hack-for-hire cyberespionage targeting journalists & activists
• iCloud phishing → Apple ID compromise
• Android spyware (ProSpy) in trusted apps
• Linked to BITTER APT ecosystem
Rising threat of commercial surveillance 👇

https://www.technadu.com/hackers-hired-to-target-android-icloud-of-egyptian-lebanese-journalists-and-activists/625617/

#Infosec #Cybersecurity #Spyware #Phishing

Alt...

Hackers Hired to Target Android, iCloud of Egyptian, Lebanese Journalists and Activists

🔒 Security News Digest - 2026-04-09

📊 28 updates from 6 sources:

🔹 BleepingComputer: Hackers exploiting Acrobat Reader zero-day flaw since December
https://www.bleepingcomputer.com/news/security/hackers-exploiting-acrobat-reader-zero-day-flaw-since-december/

🦠 Malwarebytes: This fake Windows support website delivers password-stealing malware
https://www.malwarebytes.com/blog/scams/2026/04/this-fake-windows-support-website-delivers-password-stealing-malware

🔹 SecurityWeek: Google Warns of New Campaign Targeting BPOs to Steal Corporate Data
https://www.securityweek.com/google-warns-of-new-campaign-targeting-bpos-to-steal-corporate-data/

🦠 Malwarebytes: 30,000 private Facebook images allegedly downloaded by Meta employee
https://www.malwarebytes.com/blog/data-breaches/2026/04/30000-private-facebook-images-allegedly-downloaded-by-meta-employee

🔹 BleepingComputer: Eurail says December data breach impacts 300,000 individuals
https://www.bleepingcomputer.com/news/security/eurail-says-december-data-breach-impacts-300-000-individuals/

🔹 The Hacker News: Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region
https://thehackernews.com/2026/04/bitter-linked-hack-for-hire-campaign.html

🔹 Security Boulevard: On Microsoft’s Lousy Cloud Security
https://securityboulevard.com/2026/04/on-microsofts-lousy-cloud-security/

🔹 SecurityWeek: The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security
https://www.securityweek.com/the-hidden-roi-of-visibility-better-decisions-better-behavior-better-security/

🦠 Malwarebytes: NSFW app leak exposes 70,000 prompts linked to individual users
https://www.malwarebytes.com/blog/news/2026/04/nsfw-app-leak-exposes-70000-prompts-linked-to-individual-users

🔹 Security Boulevard: NSFW app leak exposes 70,000 prompts linked to individual users
https://securityboulevard.com/2026/04/nsfw-app-leak-exposes-70000-prompts-linked-to-individual-users/

🔹 Security Boulevard: NSFW app leak exposes 70,000 prompts linked to individual users
https://securityboulevard.com/2026/04/nsfw-app-leak-exposes-70000-prompts-linked-to-individual-users-2/

🔹 Security Boulevard: The Cybersecurity Readiness Gap: Why 90% of Companies Are Still Unprepared in 2026
https://securityboulevard.com/2026/04/the-cybersecurity-readiness-gap-why-90-of-companies-are-still-unprepared-in-2026/

🔹 The Hacker News: Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
https://thehackernews.com/2026/04/adobe-reader-zero-day-exploited-via.html

🔹 The Hacker News: The Hidden Security Risks of Shadow AI in Enterprises
https://thehackernews.com/2026/04/the-hidden-security-risks-of-shadow-ai.html

🔹 Security Boulevard: The Identity Gap Blocking Agentic AI at Scale
https://securityboulevard.com/2026/04/the-identity-gap-blocking-agentic-ai-at-scale/

🔹 SecurityWeek: Palo Alto Networks, SonicWall Patch High-Severity Vulnerabilities
https://www.securityweek.com/palo-alto-networks-sonicwall-patch-high-severity-vulnerabilities/

🔹 Security Boulevard: Why Web Content Filtering Software for Schools Must Go Beyond Simple Blocking
https://securityboulevard.com/2026/04/why-web-content-filtering-software-for-schools-must-go-beyond-simple-blocking/

🔹 The Record from Recorded Future News: Cryptocurrency ATM giant Bitcoin Depot reports $3.6 million stolen in cyberattack
https://therecord.media/crypto-atm-bitcoin-depot-reports-cyberattack

🔹 Security Boulevard: Securing the AI Supply Chain: What are the Risks and Where to Start?
https://securityboulevard.com/2026/04/securing-the-ai-supply-chain-what-are-the-risks-and-where-to-start/

🔹 BleepingComputer: Webinar: From noise to signal - What threat actors are targeting next
https://www.bleepingcomputer.com/news/security/webinar-from-noise-to-signal-what-threat-actors-are-targeting-next/

🔹 Security Boulevard: Turning Email Authentication into a Revenue Engine: Why Australian MSPs Can’t Afford to Ignore DMARC-as-a-Service
https://securityboulevard.com/2026/04/turning-email-authentication-into-a-revenue-engine-why-australian-msps-cant-afford-to-ignore-dmarc-as-a-service/

🔹 SecurityWeek: Google API Keys in Android Apps Expose Gemini Endpoints to Unauthorized Access
https://www.securityweek.com/google-api-keys-in-android-apps-expose-gemini-endpoints-to-unauthorized-access/

🔹 The Hacker News: ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
https://thehackernews.com/2026/04/threatsday-bulletin-hybrid-p2p-botnet.html

🔹 Security Boulevard: Mallory Launches AI-Native Threat Intelligence Platform, Turning Global Threat Data Into Prioritized Action
https://securityboulevard.com/2026/04/mallory-launches-ai-native-threat-intelligence-platform-turning-global-threat-data-into-prioritized-action/

🦠 Malwarebytes: Scammers pose as Amazon support to steal your account
https://www.malwarebytes.com/blog/news/2026/04/scammers-pose-as-amazon-support-to-steal-your-account

🔹 Security Boulevard: The EU AI Act Data Requirements Explained | Kovrr
https://securityboulevard.com/2026/04/the-eu-ai-act-data-requirements-explained-kovrr/

🔹 SecurityWeek: Can we Trust AI? No – But Eventually We Must
https://www.securityweek.com/can-we-trust-ai-no-but-eventually-we-must/

🔹 SecurityWeek: Apple Intelligence AI Guardrails Bypassed in New Attack
https://www.securityweek.com/apple-intelligence-ai-guardrails-bypassed-in-new-attack/

#InfoSec #SecurityNews

🇩🇪 Germany’s critical industries are under active #phishing attack.

We show how SOCs can track key threats hitting finance, healthcare, IT, telecom, and manufacturing right now.

Discover how to prevent downtime, fraud, and account takeover 👇
https://any.run/cybersecurity-blog/german-industries-attack-cases/?utm_source=mastodon&utm_medium=post&utm_campaign=german_industries_attack_cases&utm_term=090426&utm_content=linktoblog

#cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//onlinestlouiscommunitycu[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d780ab3b7750000923461f
#cybersecurity #phishing #infosec #urldna #scam #infosec

Good morning. Working on a DV request for groceries this week. We're at $25/$150 if you'd like to support. Please RT for reach! Thanks so much.😍

C: $Lockdownyourlife
V: lockdownyourlife
https://www.ko-fi.com/lockdownyourlife

#MutualAidRequest #mutualaid #community #safety #privacy #tech #infosec

3 months of closed beta with 30 people. The regulatory process required to launch WIGGWIGG gave us the time to accelerate features we'd planned for later.

The web application is still the main product, but the mobile application is officially on the roadmap to complement it. (1/2)

#Privacy #Passkeys #MobileApp #PrivacyFirst #InfoSec

Does this mean that you shall also stop using curl?

AFAIK Daniel doesn't care what is used to find bugs

@rl_dane

https://mastodon.social/@bagder/116373716541500315

#curl #LLM #hallucinated #slop #AI #InfoSec #programming #technology

Join OWASP Global AppSec EU 2026 in Vienna, June 22–26, for hands-on training, epic talks, and networking with the best community vibes! 🚀

Secure your spot 👉 https://owasp.glueup.com/event/owasp-global-appsec-eu-2026-vienna-austria-162243/home.html

#OWASP #CyberSecurity #InfoSec #FridayFeeling

Disclaimer: Propaganda alert!
Disclaimer: IBM is my employer

IBM has published their "2026 Guide to AI Agents".

Now, I'm not any kind of fan of #AI, but as several of my friends here have said, we in #infosec can't simply ignore AI because some organizations are going to use it, so we need to be able to secure it.

In that spirit, I share this #IBM web page as an #educational resource.

#AI #AIagents #agenticai

https://www.ibm.com/think/topics/ai-agents

💪 Contributor "mugufinder" has shared 2,731 domains over the past 30 days 🔥 That’s a +1,969% increase, landing them in the Top10 on the domain leaderboard! Incredible work!

Your ongoing support and submissions are what keep the threat intelligence flowing, thank you. ❤️🙏

Got malicious or suspicious IPs, domains, URLs, or raw source to share?

👉 Join the fight against cybercrime: https://submit.spamhaus.org/submit/

#CyberSecurity #ThreatIntelligence #ThreatHunting #Infosec #Community

Alt...

% Monthly change in domains shared Domain leaderboard #6 | mugufinder | 2,731 domains

What if the key to better vulnerability management isn't just patching faster, but understanding why vulnerabilities keep coming back? 🔍

Help Net Security connected with #VulnCon26 speaker Alec Summers, MITRE CVE/CWE Project Lead, Principal Cybersecurity Engineer, and FIRST Member, to explore how CWE mapping is becoming a strategic layer of the vulnerability management stack.

🎤 Catch Alec's upcoming presentations at VulnCon26 next week and read the full Q&A here: https://go.first.org/BZzAf

#CVE #cybersecurity
#infosec #VulnerabilityManagement

Anthropic built a model strong enough at vulnerability research that it chose not to release it publicly. Mythos Preview is gated behind an invite-only defensive security program. It reportedly found thousands of zero-days including a 27-year-old OpenBSD bug and chained Linux kernel exploits to full system compromise. What this means for security teams and CTI.

#cybersecurity #infosec #AI https://solomonneas.dev/blog/anthropic-mythos-preview-cybersecurity-implications/

🔴 Adobe Reader zero-day exploited via malicious PDFs since Dec.
🔴 Ivanti EPMM CVE-2026-1340 added to KEV after active RCE exploitation.
🟡 APT28 hijacked router DNS on 18,000+ devices to steal Microsoft 365 tokens.
solomonneas.dev/intel
#CyberSecurity #ThreatIntel #VulnMgmt #Infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//docs[.]google[.]com/drawings/d/1kJUO4o5XHCN1aVRTQZ_pRyPXlJSl9uFTz-DvYua6FHA/edit
🧬 Analysis at: https://urldna.io/scan/69d7247a3b77500007bb89de
#cybersecurity #phishing #infosec #urldna #scam #infosec

Oh boy…
https://edition.cnn.com/2026/04/08/china/china-supercomputer-hackers-hnk-intl

> A [cyberthreat actor] has allegedly stolen a massive trove of sensitive data – including highly classified defense documents and missile schematics – from a state-run Chinese supercomputer

> The dataset, which allegedly contains more than 10 petabytes of sensitive information, is believed by experts to have been obtained from the National Supercomputing Center (NSCC) in Tianjin

#InfoSec #China

What is considered state of the art for Endpoint management, and specifically security controls (EDR, SIEM, RMM, etc.) for BSD? There usually exists clients and agents for Linux in this space. There is an abandoned(?) Wazuh port for FreeBSD that I am aware of but I would like to know what people do.

Essentially how does one manage and monitor the security of 100’s or 1,000’s of BSD endpoints like a Windows or Linux or even Mac environment would?

#askfedi #freebsd #openbsd #netbsd #infosec

If you were or are a federal employee or are a family member of one, you might want to read this and share it with others who might be concerned:

Trump’s Personnel Agency Is Asking for Federal Workers’ Medical Records

https://kffhealthnews.org/news/article/trump-opm-federal-workers-medical-records-privacy/view/republish/

#privacy #healthsec #workplace #infosec

attention anybody with substantial experience with Rust and networking: my team is hiring!!

one of few rust jobs I'm aware of that is not web 3.0 horseplop.

fully remote (US timezones), good culture, good trans-inclusive healthcare, good work/life balance, and a nice defensive cybersecurity mission i can get behind.

feel free to reach out for more details and the job posting.

#fedihired #rust #infosec #cybersecurity #ot #ics

Possible Phishing 🎣
on: ⚠️hxxps[:]//returnersres[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d66d9d3b77500009b45269
#cybersecurity #phishing #infosec #urldna #scam #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//robiox[.]com[.]af/users/2664643693/profile
🧬 Analysis at: https://urldna.io/scan/69d6a5bc3b77500009232b9a
#cybersecurity #phishing #infosec #urldna #scam #infosec

hey so this is probably completely pointless but: looking for a job (NZ or fully remote willing to hire a kiwi) in SRE, security, or linux/Unix system administration. 15 years expereince administering Linux and Unix boxes, intermediate level of experience working with docker compose and containerisation and container security. No prior job experience unfortunately. Currently running an entire multi-machine personal cloud infrastructure with a demonstration of all the services I have running at https://status.highenergymagic.net. #fedihired #infosec #cybersecurity #linux #unix #docker #sre #DevOps

Please boost for reach, any job offers please DM me.

Possible Phishing 🎣
on: ⚠️hxxps[:]//btnewmailser[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d689b33b77500009232760
#cybersecurity #phishing #infosec #urldna #scam #infosec

#Microsoft locks account that #VeraCrypt maintainer uses to sign #Windows bootloaders with no explanation or route for appeal. If they don't fix this, in a few months every Windows computer that uses VeraCrypt whole-disk encryption will stop being able to boot and all the data on it that isn't backed up elsewhere will be lost. 🤦
If this doesn't convince you big tech has too much control, I don't know what will.
h/t @zackwhittaker
https://techcrunch.com/2026/04/08/veracrypt-encryption-software-windows-microsoft-lock-boot-issues/
#infosec #privacy #TechIsShitDispatch

The Register: Microsoft calls time on ASP.NET Core 2.3 on .NET Framework https://www.theregister.com/2026/04/08/aspnet_net_framework/

From yesterday:

Hundreds of orgs compromised daily in Microsoft device code phishing attacks https://www.theregister.com/2026/04/07/microsoft_device_code_phishing/ @theregister #Microsoft #Windows #infosec #phishing

Possible Phishing 🎣
on: ⚠️hxxps[:]//att53[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/69d659333b77500009b44f4c
#cybersecurity #phishing #infosec #urldna #scam #infosec